@kweaver-ai/kweaver-sdk 0.6.3 → 0.6.4

package/README.md

@@ -31,6 +31,8 @@ export KWEAVER_BASE_URL=https://your-kweaver-instance.com
 export KWEAVER_TOKEN=your-token
 ```
 
+With both set, API commands use that token even if you never ran `auth login`. You can also run **`kweaver auth status`**, **`kweaver auth whoami`** (supports `--json`), and **`kweaver config show`** when there is **no** current platform in `~/.kweaver/` — the CLI decodes the token locally (JWT only). If the token is opaque, identity fields are omitted and a short hint is printed.
+
 ### Business domain (platform)
 
 Set or verify **before** calling list/query APIs that scope by tenant. DIP deployments often need a UUID, not only `bd_public`.
@@ -151,11 +153,13 @@ const skillMd = await client.skills.fetchContent("skill-id");
 ## CLI Reference
 
 ```
-kweaver auth login <url> [--alias name] [--no-auth] [--no-browser] [-u user] [-p pass] [--playwright] [--insecure|-k]
+kweaver auth login <url> [--alias name] [--no-auth] [--no-browser] [-u user] [-p pass] [--http-signin] [--playwright] [--insecure|-k]
+# -u/-p: tries HTTP /oauth2/signin first (refresh_token). If studioweb is missing: falls back to Playwright when installed, else prints install hint. --http-signin: HTTP only. --playwright: force browser automation.
 kweaver auth login <url> --client-id ID --client-secret S --refresh-token T   (headless login)
 kweaver auth export [url|alias] [--json]   (export command to run on a headless host)
-kweaver auth status/list/use/delete/logout
-kweaver config show / list-bd / set-bd <value>   # platform business domain — after login
+kweaver auth status / whoami [url|alias] [--json]   # whoami: --json; with KWEAVER_BASE_URL+KWEAVER_TOKEN when no ~/.kweaver/ platform
+kweaver auth list/use/delete/logout
+kweaver config show / list-bd / set-bd <value>   # platform business domain — show/list-bd work with KWEAVER_BASE_URL (+ KWEAVER_TOKEN for list-bd)
 kweaver token
 kweaver ds list/get/delete/tables/connect
 kweaver ds import-csv <ds_id> --files <glob> [--table-prefix <p>] [--batch-size 500] [--recreate]

package/README.zh.md

@@ -31,6 +31,8 @@ export KWEAVER_BASE_URL=https://your-kweaver-instance.com
 export KWEAVER_TOKEN=your-token
 ```
 
+两者同时设置时，即使未执行 `auth login`，业务命令也会使用该 token。若 **`~/.kweaver/` 无当前平台**，仍可使用 **`kweaver auth status`**、**`kweaver auth whoami`**（支持 `--json`）、**`kweaver config show`**：CLI 会在本地解 JWT 展示身份；若 token 为 opaque，则省略身份字段并给出简短提示。
+
 ### 业务域（平台配置）
 
 在调用依赖租户范围的接口前，应先确认业务域；DIP 环境通常使用 **UUID**，不能长期只依赖默认 `bd_public`。
@@ -144,11 +146,13 @@ const skillMd = await client.skills.fetchContent("skill-id");
 ## 命令速查
 
 ```
-kweaver auth login <url> [--alias name] [--no-auth] [--no-browser] [-u user] [-p pass] [--playwright] [--insecure|-k]
+kweaver auth login <url> [--alias name] [--no-auth] [--no-browser] [-u user] [-p pass] [--http-signin] [--playwright] [--insecure|-k]
+# -u/-p：默认先试 HTTP /oauth2/signin（可拿 refresh_token）；无 studioweb 时：已装 Playwright 则回退无头浏览器，否则提示安装 Playwright；--http-signin 仅 HTTP；--playwright 强制浏览器
 kweaver auth login <url> --client-id ID --client-secret S --refresh-token T   (无浏览器登录)
 kweaver auth export [url|alias] [--json]   (导出在无浏览器机器上运行的命令)
-kweaver auth status/list/use/delete/logout
-kweaver config show / list-bd / set-bd <value>   # 平台业务域，登录后优先
+kweaver auth status / whoami [url|alias] [--json]   # whoami 支持 --json；无 ~/.kweaver/ 当前平台时可配 KWEAVER_BASE_URL+KWEAVER_TOKEN
+kweaver auth list/use/delete/logout
+kweaver config show / list-bd / set-bd <value>   # 业务域；show/list-bd 在无已保存平台时可与 env 配对
 kweaver token
 kweaver ds list/get/delete/tables/connect
 kweaver dataflow list/run/runs/logs

package/dist/api/dataflow.js

@@ -82,7 +82,10 @@ export async function pollDataflowResults(options) {
                 return latest;
             }
             if (latest.status === "failed" || latest.status === "error") {
-                const reason = latest.reason ? `: ${latest.reason}` : "";
+                const reasonVal = latest.reason;
+                const reason = reasonVal
+                    ? `: ${typeof reasonVal === "string" ? reasonVal : JSON.stringify(reasonVal)}`
+                    : "";
                 throw new Error(`Dataflow run ${latest.status}${reason}`);
             }
         }

package/dist/auth/oauth.d.ts

@@ -1,4 +1,19 @@
 import { type TokenConfig } from "../config/store.js";
+/**
+ * Studioweb hardcoded LOGIN public key (PEM) — the single key used for HTTP `/oauth2/signin`.
+ * Source: kweaver-ai/kweaver `deploy/auto_cofig/auto_config.sh` `LOGIN_PUBLIC_KEY`.
+ */
+export declare const STUDIOWEB_LOGIN_PUBLIC_KEY_PEM = "-----BEGIN PUBLIC KEY-----\nMIIBIjANBgkqhkiG9w0BAQEFAAOCAQ8AMIIBCgKCAQEAsyOstgbYuubBi2PUqeVj\nGKlkwVUY6w1Y8d4k116dI2SkZI8fxcjHALv77kItO4jYLVplk9gO4HAtsisnNE2o\nwlYIqdmyEPMwupaeFFFcg751oiTXJiYbtX7ABzU5KQYPjRSEjMq6i5qu/mL67XTk\nhvKwrC83zme66qaKApmKupDODPb0RRkutK/zHfd1zL7sciBQ6psnNadh8pE24w8O\n2XVy1v2bgSNkGHABgncR7seyIg81JQ3c/Axxd6GsTztjLnlvGAlmT1TphE84mi99\nfUaGD2A1u1qdIuNc+XuisFeNcUW6fct0+x97eS2eEGRr/7qxWmO/P20sFVzXc2bF\n1QIDAQAB\n-----END PUBLIC KEY-----";
+/**
+ * Default RSA modulus (hex) for `/oauth2/signin` when `__NEXT_DATA__` has no `publicKey` / `modulus`.
+ * DIP / EACP / AnyShare-style deployments use the ISFWeb `core/auth` PUBLIC_KEY (1024-bit, exp 65537).
+ * Prefer key material from the sign-in page when present.
+ */
+export declare const DEFAULT_SIGNIN_RSA_MODULUS_HEX = "C1D9F84B95AF6B331FBA2D64D76A39CAD7529DA79DB4B3543E4DF3DF21723FEC6F7E2F6602E11037339AE0462DF6B39F94150FC256A505A8CA95BB3699E25C3FB84764D6A1DC3F483A2C1DC4F70925D85725151D0CFBF1EB5A6C4FA0E37ED32FED150C717CD82C528745CDB761D17635AC855421B3CBBEE7D405B2CA5C70CFA7";
+/**
+ * Build an SPKI PEM from an RSA modulus (hex) and public exponent (default 65537 / 0x10001).
+ */
+export declare function rsaModulusHexToSpkiPem(modulusHex: string, exponent?: number): string;
 /** POSIX shell single-quote escaping for copy-paste commands. */
 export declare function shellQuoteForShell(value: string): string;
 /**
@@ -11,6 +26,12 @@ export declare function buildCopyCommand(baseUrl: string, clientId: string, clie
  */
 export declare function buildCallbackHtml(copyCommand: string): string;
 export declare function normalizeBaseUrl(value: string): string;
+/**
+ * Temporarily disable TLS certificate verification for Node `fetch` (sets
+ * NODE_TLS_REJECT_UNAUTHORIZED). Used for `--insecure` login and token refresh.
+ */
+/** @internal Exported for CLI env-only identity resolution (`env-snapshot.ts`). */
+export declare function runWithTlsInsecure<T>(tlsInsecure: boolean | undefined, fn: () => Promise<T>): Promise<T>;
 /**
  * OAuth2 Authorization Code login flow.
  * 1. Register client (if not already registered), OR use a provided client ID
@@ -50,6 +71,54 @@ export declare function playwrightLogin(baseUrl: string, options?: {
     scope?: string;
     tlsInsecure?: boolean;
 }): Promise<TokenConfig>;
+/**
+ * Parse Next.js `__NEXT_DATA__` from the OAuth2 sign-in HTML shell (CSRF + optional challenge/remember for POST /oauth2/signin).
+ * Hydra `login_challenge` may appear only in the sign-in URL; use that when `pageProps.challenge` is absent.
+ */
+export declare function parseSigninPageHtmlProps(html: string): {
+    challenge?: string;
+    csrftoken: string;
+    remember?: boolean;
+    /** Hex modulus, PEM, or Base64 SPKI from page (nested search + HTML regex fallback). */
+    rsaPublicKeyMaterial?: string;
+};
+/**
+ * True when {@link oauth2PasswordSigninLogin} failed because the Studio web sign-in shell
+ * (`/interface/studioweb/login`) is missing or unreachable — callers may fall back to Playwright.
+ */
+export declare function isStudiowebShellUnavailableError(err: unknown): boolean;
+/**
+ * OAuth2 Authorization Code login using HTTP **only**: `GET /oauth2/signin` (Next.js shell) and
+ * `POST /oauth2/signin` with an RSA PKCS#1 v1.5–encrypted password (same as the browser `rsa.min` / Studio
+ * `core/mediator/auth` path).
+ *
+ * `/oauth2/auth` uses `product` `adp` by default (KWeaver Studio shell); set `oauthProduct` or `KWEAVER_OAUTH_PRODUCT` for DIP (`dip`).
+ * Password ciphertext defaults to **single-line base64** (PyCrypto-style); set `KWEAVER_SIGNIN_PASSWORD_B64_RSA_MIN=1` for rsa.min-style wrapped lines.
+ */
+export declare function oauth2PasswordSigninLogin(baseUrl: string, options: {
+    username: string;
+    password: string;
+    port?: number;
+    scope?: string;
+    clientId?: string;
+    clientSecret?: string;
+    tlsInsecure?: boolean;
+    /**
+     * `product` query for `/oauth2/auth` (must match deployment). Default `adp`; DIP deployments often use `dip`.
+     * @default KWEAVER_OAUTH_PRODUCT env or `adp`
+     */
+    oauthProduct?: string;
+    /**
+     * Password ciphertext: `rsa.min` uses newline every 64 chars; PyCrypto / some gateways expect a single base64 line.
+     * @default false (single-line base64, matches kweaver-core EACP-style encryption)
+     */
+    signinPasswordBase64Plain?: boolean;
+    /**
+     * PEM / hex / Base64-SPKI file path — overrides key from the sign-in HTML.
+     * Env: `KWEAVER_SIGNIN_RSA_PUBLIC_KEY` (same path semantics as CLI `--signin-public-key-file`).
+     */
+    signinPublicKeyPemPath?: string;
+}): Promise<TokenConfig>;
 /**
  * Log in on a headless machine using OAuth2 client credentials and a refresh token (no browser).
  * Exchanges the refresh token for a new access token and persists ~/.kweaver/ state.

package/dist/auth/oauth.js

@@ -1,3 +1,5 @@
+import { readFile } from "node:fs/promises";
+import { createPublicKey } from "node:crypto";
 import { isNoAuth } from "../config/no-auth.js";
 import { deleteClientConfig, getCurrentPlatform, loadClientConfig, loadTokenConfig, loadUserTokenConfig, resolveUserId, saveClientConfig, saveNoAuthPlatform, saveTokenConfig, setCurrentPlatform, } from "../config/store.js";
 import { HttpError, NetworkRequestError, fetchWithRetry } from "../utils/http.js";
@@ -6,6 +8,229 @@ const TOKEN_TTL_SECONDS = 3600;
 const REFRESH_THRESHOLD_SEC = 60;
 const DEFAULT_REDIRECT_PORT = 9010;
 const DEFAULT_SCOPE = "openid offline all";
+/**
+ * Studioweb hardcoded LOGIN public key (PEM) — the single key used for HTTP `/oauth2/signin`.
+ * Source: kweaver-ai/kweaver `deploy/auto_cofig/auto_config.sh` `LOGIN_PUBLIC_KEY`.
+ */
+export const STUDIOWEB_LOGIN_PUBLIC_KEY_PEM = `-----BEGIN PUBLIC KEY-----
+MIIBIjANBgkqhkiG9w0BAQEFAAOCAQ8AMIIBCgKCAQEAsyOstgbYuubBi2PUqeVj
+GKlkwVUY6w1Y8d4k116dI2SkZI8fxcjHALv77kItO4jYLVplk9gO4HAtsisnNE2o
+wlYIqdmyEPMwupaeFFFcg751oiTXJiYbtX7ABzU5KQYPjRSEjMq6i5qu/mL67XTk
+hvKwrC83zme66qaKApmKupDODPb0RRkutK/zHfd1zL7sciBQ6psnNadh8pE24w8O
+2XVy1v2bgSNkGHABgncR7seyIg81JQ3c/Axxd6GsTztjLnlvGAlmT1TphE84mi99
+fUaGD2A1u1qdIuNc+XuisFeNcUW6fct0+x97eS2eEGRr/7qxWmO/P20sFVzXc2bF
+1QIDAQAB
+-----END PUBLIC KEY-----`;
+/**
+ * Default RSA modulus (hex) for `/oauth2/signin` when `__NEXT_DATA__` has no `publicKey` / `modulus`.
+ * DIP / EACP / AnyShare-style deployments use the ISFWeb `core/auth` PUBLIC_KEY (1024-bit, exp 65537).
+ * Prefer key material from the sign-in page when present.
+ */
+export const DEFAULT_SIGNIN_RSA_MODULUS_HEX = "C1D9F84B95AF6B331FBA2D64D76A39CAD7529DA79DB4B3543E4DF3DF21723FEC6F7E2F6602E11037339AE0462DF6B39F94150FC256A505A8CA95BB3699E25C3FB84764D6A1DC3F483A2C1DC4F70925D85725151D0CFBF1EB5A6C4FA0E37ED32FED150C717CD82C528745CDB761D17635AC855421B3CBBEE7D405B2CA5C70CFA7";
+/**
+ * Default PEM for HTTP `/oauth2/signin`: **the fixed `STUDIOWEB_LOGIN_PUBLIC_KEY_PEM`** (matches
+ * `kweaver-ai/kweaver/deploy/auto_cofig/auto_config.sh` `LOGIN_PUBLIC_KEY`). KWeaver platforms have
+ * standardized on this single key — no fallback list, no probing of `__NEXT_DATA__` page key, no
+ * `trying next candidate…` noise. Override with `--signin-public-key-file` /
+ * `KWEAVER_SIGNIN_RSA_PUBLIC_KEY` if a deployment ever ships a different public key.
+ */
+function buildHttpSigninPemCandidates(_parsedMaterial) {
+    return [STUDIOWEB_LOGIN_PUBLIC_KEY_PEM];
+}
+/**
+ * Build an SPKI PEM from an RSA modulus (hex) and public exponent (default 65537 / 0x10001).
+ */
+export function rsaModulusHexToSpkiPem(modulusHex, exponent = 65537) {
+    const hex = modulusHex.replace(/\s+/g, "");
+    if (!/^[0-9a-fA-F]+$/.test(hex) || hex.length % 2 !== 0) {
+        throw new Error("RSA modulus must be an even-length hex string.");
+    }
+    const nBuf = Buffer.from(hex, "hex");
+    const eBytes = [];
+    let exp = exponent;
+    while (exp > 0) {
+        eBytes.unshift(exp & 0xff);
+        exp >>= 8;
+    }
+    const eBuf = Buffer.from(eBytes);
+    const key = createPublicKey({
+        key: {
+            kty: "RSA",
+            n: nBuf.toString("base64url"),
+            e: eBuf.toString("base64url"),
+        },
+        format: "jwk",
+    });
+    return key.export({ type: "spki", format: "pem" });
+}
+/**
+ * Import SPKI DER from Base64 (no PEM headers) — same shape as af-agent `RSA.importKey(base64.b64decode(...))`.
+ */
+function tryDerSpkiBase64ToPem(material) {
+    const trimmed = material.replace(/\s+/g, "");
+    if (trimmed.length < 80 || !/^[A-Za-z0-9+/]+=*$/.test(trimmed)) {
+        return null;
+    }
+    try {
+        const buf = Buffer.from(trimmed, "base64");
+        const key = createPublicKey({ key: buf, format: "der", type: "spki" });
+        return key.export({ type: "spki", format: "pem" });
+    }
+    catch {
+        return null;
+    }
+}
+function isLikelyRsaHexModulusString(s) {
+    const h = s.replace(/\s+/g, "");
+    return h.length >= 128 && h.length % 2 === 0 && /^[0-9a-fA-F]+$/.test(h);
+}
+function isLikelySpkiBase64String(s) {
+    const t = s.replace(/\s+/g, "");
+    if (t.length < 200 || !/^[A-Za-z0-9+/]+=*$/.test(t)) {
+        return false;
+    }
+    return tryDerSpkiBase64ToPem(t) !== null;
+}
+/**
+ * PEM from page (`BEGIN PUBLIC KEY` / `BEGIN RSA PUBLIC KEY`), hex modulus, or Base64 SPKI DER.
+ * When `material` is missing, uses the built-in modulus (`DEFAULT_SIGNIN_RSA_MODULUS_HEX`) so
+ * `--http-signin` does not require extra CLI flags. Opt out with `KWEAVER_SIGNIN_DISALLOW_BUILTIN_MODULUS=1`.
+ */
+function resolveSigninPublicKeyPem(material, opts) {
+    const disallowBuiltin = opts?.allowBuiltinModulus === false || process.env.KWEAVER_SIGNIN_DISALLOW_BUILTIN_MODULUS === "1";
+    if (material?.trim()) {
+        const m = material.trim();
+        if (m.includes("BEGIN PUBLIC KEY") || m.includes("BEGIN RSA PUBLIC KEY")) {
+            return m;
+        }
+        const hex = m.replace(/\s+/g, "");
+        if (/^[0-9a-fA-F]+$/.test(hex) && hex.length % 2 === 0) {
+            return rsaModulusHexToSpkiPem(hex);
+        }
+        const fromDer = tryDerSpkiBase64ToPem(m);
+        if (fromDer) {
+            return fromDer;
+        }
+        throw new Error("RSA public key material is present but could not be parsed (expected PEM, hex modulus, or Base64 SPKI).");
+    }
+    if (disallowBuiltin) {
+        throw new Error("No RSA public key in sign-in HTML and built-in modulus disabled (KWEAVER_SIGNIN_DISALLOW_BUILTIN_MODULUS=1). " +
+            "Use --signin-public-key-file or KWEAVER_SIGNIN_RSA_PUBLIC_KEY.");
+    }
+    return rsaModulusHexToSpkiPem(DEFAULT_SIGNIN_RSA_MODULUS_HEX.replace(/\s+/g, ""));
+}
+/**
+ * Recursively find a string that looks like PEM, hex modulus, or Base64 SPKI in `pageProps` (nested configs).
+ */
+function deepFindSigninRsaMaterial(obj, depth, seen) {
+    if (depth < 0 || obj === null || obj === undefined) {
+        return undefined;
+    }
+    if (typeof obj === "string") {
+        const t = obj.trim();
+        if (!t) {
+            return undefined;
+        }
+        if (t.includes("BEGIN PUBLIC KEY") || t.includes("BEGIN RSA PUBLIC KEY")) {
+            return t;
+        }
+        if (isLikelyRsaHexModulusString(t)) {
+            return t.replace(/\s+/g, "");
+        }
+        if (isLikelySpkiBase64String(t)) {
+            return t.replace(/\s+/g, "");
+        }
+        return undefined;
+    }
+    if (typeof obj !== "object") {
+        return undefined;
+    }
+    if (seen.has(obj)) {
+        return undefined;
+    }
+    seen.add(obj);
+    if (Array.isArray(obj)) {
+        for (const el of obj) {
+            const r = deepFindSigninRsaMaterial(el, depth - 1, seen);
+            if (r) {
+                return r;
+            }
+        }
+        return undefined;
+    }
+    const rec = obj;
+    for (const k of Object.keys(rec)) {
+        const r = deepFindSigninRsaMaterial(rec[k], depth - 1, seen);
+        if (r) {
+            return r;
+        }
+    }
+    return undefined;
+}
+/**
+ * Regex fallback when JSON path differs (escaped quotes, minified bundles, inline scripts).
+ * Some deployments put the SPKI Base64 as a raw substring (no JSON key).
+ */
+function extractSigninRsaMaterialFromHtml(html) {
+    const pemPub = html.match(/-----BEGIN PUBLIC KEY-----[\s\S]*?-----END PUBLIC KEY-----/);
+    if (pemPub) {
+        return pemPub[0].trim();
+    }
+    const pemRsa = html.match(/-----BEGIN RSA PUBLIC KEY-----[\s\S]*?-----END RSA PUBLIC KEY-----/);
+    if (pemRsa) {
+        return pemRsa[0].trim();
+    }
+    const jsonPatterns = [
+        /"modulus"\s*:\s*"([0-9a-fA-F]{128,})"/,
+        /'modulus'\s*:\s*'([0-9a-fA-F]{128,})'/,
+        /"(?:publicKey|rsaPublicKey|public_key|encryptPublicKey|rsaModulus|passwordPublicKey|loginPublicKey|pwdPublicKey|encryptKey)"\s*:\s*"([A-Za-z0-9+/=\s]{200,})"/,
+        /'(?:publicKey|rsaPublicKey|public_key)'\s*:\s*'([A-Za-z0-9+/=]{200,})'/,
+    ];
+    for (const re of jsonPatterns) {
+        const m = html.match(re);
+        if (m?.[1]) {
+            return m[1].replace(/\s+/g, "");
+        }
+    }
+    // Raw SPKI Base64 blocks (2048-bit RSA SPKI often starts with MIIBIjAN…)
+    const rawSpki = html.match(/(MIIBIjANBgkqhkiG9w0BAQEFAAOCAQ8AMIIBCgKCAQEA[A-Za-z0-9+/=]{80,800})/);
+    if (rawSpki) {
+        return rawSpki[1].replace(/\s+/g, "");
+    }
+    const rawSpki1024 = html.match(/(MIGfMA0GCSqGSIb3DQEBAQUAA4GNADCBiQKBgQ[A-Za-z0-9+/=\s]{80,500})/);
+    if (rawSpki1024) {
+        return rawSpki1024[1].replace(/\s+/g, "");
+    }
+    return undefined;
+}
+/** Match `rsa.min` / Studio `rsaEncrypt`: base64 with newline every 64 chars (EACP may validate format). */
+function formatPasswordBase64LikeRsaMin(b64) {
+    return b64.replace(/(.{64})/g, "$1\n");
+}
+function extractRsaPublicKeyMaterialFromPageProps(pageProps) {
+    const keys = [
+        "publicKey",
+        "rsaPublicKey",
+        "public_key",
+        "modulus",
+        "encryptPublicKey",
+        "pubKey",
+        "rsaModulus",
+        "passwordPublicKey",
+        "loginPublicKey",
+        "encryptKey",
+        "pwdPublicKey",
+        "modulusHex",
+        "rsaPublicKeyHex",
+    ];
+    for (const k of keys) {
+        const v = pageProps[k];
+        if (typeof v === "string" && v.trim()) {
+            return v.trim();
+        }
+    }
+    return deepFindSigninRsaMaterial(pageProps, 5, new Set());
+}
 /** Best-effort fetch of display name via EACP userinfo (ShareServer). */
 async function fetchDisplayName(baseUrl, accessToken, tlsInsecure) {
     try {
@@ -115,7 +340,8 @@ export function normalizeBaseUrl(value) {
  * Temporarily disable TLS certificate verification for Node `fetch` (sets
  * NODE_TLS_REJECT_UNAUTHORIZED). Used for `--insecure` login and token refresh.
  */
-async function runWithTlsInsecure(tlsInsecure, fn) {
+/** @internal Exported for CLI env-only identity resolution (`env-snapshot.ts`). */
+export async function runWithTlsInsecure(tlsInsecure, fn) {
     if (!tlsInsecure) {
         return fn();
     }
@@ -697,6 +923,419 @@ export async function playwrightLogin(baseUrl, options) {
         return token;
     });
 }
+function mergeCookieJarForSignin(existing, response) {
+    const setCookies = typeof response.headers.getSetCookie === "function"
+        ? response.headers.getSetCookie()
+        : (() => {
+            const raw = response.headers.get("set-cookie");
+            return raw ? [raw] : [];
+        })();
+    const map = new Map();
+    for (const part of existing
+        .split(";")
+        .map((s) => s.trim())
+        .filter(Boolean)) {
+        const eq = part.indexOf("=");
+        if (eq > 0)
+            map.set(part.slice(0, eq), part.slice(eq + 1));
+    }
+    for (const sc of setCookies) {
+        const first = sc.split(";")[0]?.trim() ?? "";
+        const eq = first.indexOf("=");
+        if (eq > 0)
+            map.set(first.slice(0, eq), first.slice(eq + 1));
+    }
+    return [...map.entries()].map(([k, v]) => `${k}=${v}`).join("; ");
+}
+/**
+ * Parse query parameters from a `Location` header value (absolute or relative URL).
+ */
+function parseQueryFromLocationHeader(location) {
+    const q = location.includes("?") ? location.slice(location.indexOf("?")) : "";
+    const params = new URLSearchParams(q.startsWith("?") ? q.slice(1) : q);
+    const out = {};
+    params.forEach((v, k) => {
+        out[k] = v;
+    });
+    return out;
+}
+/**
+ * Parse Next.js `__NEXT_DATA__` from the OAuth2 sign-in HTML shell (CSRF + optional challenge/remember for POST /oauth2/signin).
+ * Hydra `login_challenge` may appear only in the sign-in URL; use that when `pageProps.challenge` is absent.
+ */
+export function parseSigninPageHtmlProps(html) {
+    const m = html.match(/<script[^>]*\bid=["']__NEXT_DATA__["'][^>]*>([\s\S]*?)<\/script>/i);
+    if (!m) {
+        throw new Error("Could not find __NEXT_DATA__ on the sign-in page.");
+    }
+    const data = JSON.parse(m[1]);
+    const pageProps = data.props?.pageProps;
+    if (!pageProps) {
+        throw new Error("Invalid __NEXT_DATA__: missing pageProps.");
+    }
+    const challenge = pageProps.challenge;
+    const csrftoken = pageProps.csrftoken ?? pageProps._csrf;
+    if (typeof csrftoken !== "string") {
+        throw new Error("Sign-in page did not expose csrftoken (expected in __NEXT_DATA__.props.pageProps).");
+    }
+    const challengeStr = typeof challenge === "string" ? challenge : undefined;
+    const rememberRaw = pageProps.remember;
+    const remember = typeof rememberRaw === "boolean"
+        ? rememberRaw
+        : typeof rememberRaw === "string"
+            ? rememberRaw === "true"
+            : undefined;
+    let rsaPublicKeyMaterial = extractRsaPublicKeyMaterialFromPageProps(pageProps);
+    if (!rsaPublicKeyMaterial) {
+        rsaPublicKeyMaterial = deepFindSigninRsaMaterial(data, 10, new Set());
+    }
+    if (!rsaPublicKeyMaterial) {
+        rsaPublicKeyMaterial = extractSigninRsaMaterialFromHtml(html);
+    }
+    return { challenge: challengeStr, csrftoken, remember, rsaPublicKeyMaterial };
+}
+async function followSigninRedirectsUntilCallback(startUrl, initialJar, state, redirectUri, base, scope) {
+    let url = startUrl;
+    let jar = initialJar;
+    const callbackHost = new URL(redirectUri).origin;
+    const callbackPath = new URL(redirectUri).pathname;
+    for (let hop = 0; hop < 40; hop++) {
+        const resp = await fetch(url, {
+            method: "GET",
+            headers: {
+                Cookie: jar,
+                Accept: "text/html,application/xhtml+xml,application/xml;q=0.9,*/*;q=0.8",
+            },
+            redirect: "manual",
+        });
+        jar = mergeCookieJarForSignin(jar, resp);
+        if (resp.status === 302 || resp.status === 303 || resp.status === 307 || resp.status === 308) {
+            const loc = resp.headers.get("location");
+            if (!loc) {
+                throw new HttpError(resp.status, "Missing Location", "");
+            }
+            const next = new URL(loc, url);
+            if (next.origin === callbackHost && next.pathname === callbackPath) {
+                const code = next.searchParams.get("code");
+                const st = next.searchParams.get("state");
+                if (st !== state) {
+                    throw new Error("OAuth2 state mismatch — possible CSRF attack.");
+                }
+                const err = next.searchParams.get("error");
+                if (err) {
+                    const desc = next.searchParams.get("error_description") ?? "";
+                    throw new Error(desc ? `Authorization failed: ${err} — ${desc}` : `Authorization failed: ${err}`);
+                }
+                if (!code) {
+                    throw new Error("Callback URL missing authorization code.");
+                }
+                return { code, jar };
+            }
+            url = next.href;
+            continue;
+        }
+        if (resp.status === 200) {
+            const html = await resp.text();
+            const consentResult = await tryAcceptConsentAfterSignin(base, url, html, jar, scope, state, redirectUri);
+            if (consentResult) {
+                return consentResult;
+            }
+            throw new Error(`Unexpected OAuth page (HTTP 200) at ${url.slice(0, 120)}… ` +
+                `If this is a consent or MFA screen, use browser login or Playwright.`);
+        }
+        const text = await resp.text().catch(() => "");
+        throw new HttpError(resp.status, resp.statusText, text);
+    }
+    throw new Error("Too many OAuth redirects.");
+}
+async function tryAcceptConsentAfterSignin(base, pageUrl, html, jar, scope, state, redirectUri) {
+    let data;
+    try {
+        const m = html.match(/<script[^>]*\bid=["']__NEXT_DATA__["'][^>]*>([\s\S]*?)<\/script>/i);
+        if (!m) {
+            return null;
+        }
+        data = JSON.parse(m[1]);
+    }
+    catch {
+        return null;
+    }
+    const pageProps = data.props?.pageProps;
+    if (!pageProps) {
+        return null;
+    }
+    const consentChallenge = pageProps.consent_challenge;
+    if (typeof consentChallenge !== "string") {
+        return null;
+    }
+    const scopes = scope.split(/\s+/).filter(Boolean);
+    const body = new URLSearchParams();
+    body.set("consent_challenge", consentChallenge);
+    for (const s of scopes) {
+        body.append("grant_scope", s);
+    }
+    const resp = await fetch(`${base}/oauth2/consent`, {
+        method: "POST",
+        headers: {
+            Cookie: jar,
+            "Content-Type": "application/x-www-form-urlencoded",
+            Accept: "text/html,application/xhtml+xml,application/json;q=0.9,*/*;q=0.8",
+        },
+        body: body.toString(),
+        redirect: "manual",
+    });
+    const newJar = mergeCookieJarForSignin(jar, resp);
+    if (resp.status === 302 || resp.status === 303 || resp.status === 307) {
+        const loc = resp.headers.get("location");
+        if (!loc) {
+            throw new HttpError(resp.status, "Missing Location after consent", "");
+        }
+        return followSigninRedirectsUntilCallback(new URL(loc, pageUrl).href, newJar, state, redirectUri, base, scope);
+    }
+    return null;
+}
+const STUDIOWEB_SHELL_UNAVAILABLE_SNIPPETS = [
+    "Studioweb signin endpoint not available",
+    "Cannot reach studioweb signin endpoint",
+];
+/**
+ * True when {@link oauth2PasswordSigninLogin} failed because the Studio web sign-in shell
+ * (`/interface/studioweb/login`) is missing or unreachable — callers may fall back to Playwright.
+ */
+export function isStudiowebShellUnavailableError(err) {
+    const msg = err instanceof Error ? err.message : String(err);
+    return STUDIOWEB_SHELL_UNAVAILABLE_SNIPPETS.some((s) => msg.includes(s));
+}
+/**
+ * OAuth2 Authorization Code login using HTTP **only**: `GET /oauth2/signin` (Next.js shell) and
+ * `POST /oauth2/signin` with an RSA PKCS#1 v1.5–encrypted password (same as the browser `rsa.min` / Studio
+ * `core/mediator/auth` path).
+ *
+ * `/oauth2/auth` uses `product` `adp` by default (KWeaver Studio shell); set `oauthProduct` or `KWEAVER_OAUTH_PRODUCT` for DIP (`dip`).
+ * Password ciphertext defaults to **single-line base64** (PyCrypto-style); set `KWEAVER_SIGNIN_PASSWORD_B64_RSA_MIN=1` for rsa.min-style wrapped lines.
+ */
+export async function oauth2PasswordSigninLogin(baseUrl, options) {
+    return runWithTlsInsecure(options.tlsInsecure, async () => {
+        const { publicEncrypt, constants: cryptoConstants } = await import("node:crypto");
+        const { randomBytes } = await import("node:crypto");
+        const base = normalizeBaseUrl(baseUrl);
+        const port = options.port ?? DEFAULT_REDIRECT_PORT;
+        const scope = options.scope ?? DEFAULT_SCOPE;
+        const redirectUri = `http://127.0.0.1:${port}/callback`;
+        const state = randomBytes(12).toString("hex");
+        const oauthProduct = options.oauthProduct?.trim() ||
+            (typeof process.env.KWEAVER_OAUTH_PRODUCT === "string" && process.env.KWEAVER_OAUTH_PRODUCT.trim()
+                ? process.env.KWEAVER_OAUTH_PRODUCT.trim()
+                : "adp");
+        // Pre-flight: verify studioweb signin shell exists (same entry as deploy auto_config.sh get_token).
+        // If the deployment lacks studioweb, abort before OAuth client registration.
+        const studiowebProbeUrl = `${base}/interface/studioweb/login?lang=zh-cn&state=${encodeURIComponent(state)}` +
+            `&x-forwarded-prefix=&integrated=false&product=${encodeURIComponent(oauthProduct)}&_t=${Date.now()}`;
+        let probeResp;
+        try {
+            probeResp = await fetch(studiowebProbeUrl, { method: "GET", redirect: "manual" });
+        }
+        catch (cause) {
+            throw new Error(`Cannot reach studioweb signin endpoint at ${base}/interface/studioweb/login. ` +
+                `The deployment may not include studioweb. Use \`kweaver auth login ${base}\` ` +
+                `(OAuth code flow) instead.\n  Cause: ${cause instanceof Error ? cause.message : String(cause)}`);
+        }
+        const probeOk2xx = probeResp.status >= 200 && probeResp.status < 300;
+        const probeOkRedirect = [301, 302, 303, 307, 308].includes(probeResp.status);
+        await probeResp.text().catch(() => "");
+        if (!probeOk2xx && !probeOkRedirect) {
+            throw new Error(`Studioweb signin endpoint not available at ${base}/interface/studioweb/login ` +
+                `(HTTP ${probeResp.status}). The deployment may not include studioweb. ` +
+                `Use \`kweaver auth login ${base}\` (OAuth code flow) instead.`);
+        }
+        let client;
+        try {
+            client = await resolveOrRegisterClient(base, redirectUri, scope, {
+                clientId: options.clientId,
+                clientSecret: options.clientSecret,
+            });
+        }
+        catch (e) {
+            if (e instanceof HttpError && e.status === 404) {
+                process.stderr.write("OAuth2 endpoint not found (404). Saving platform in no-auth mode.\n");
+                return saveNoAuthPlatform(base, { tlsInsecure: options.tlsInsecure });
+            }
+            throw e;
+        }
+        const usePkce = !client.clientSecret;
+        const pkce = usePkce ? await generatePkce() : null;
+        const authParams = new URLSearchParams({
+            redirect_uri: redirectUri,
+            "x-forwarded-prefix": "",
+            client_id: client.clientId,
+            scope,
+            response_type: "code",
+            state,
+            lang: "zh-cn",
+            product: oauthProduct,
+        });
+        if (pkce) {
+            authParams.set("code_challenge", pkce.challenge);
+            authParams.set("code_challenge_method", "S256");
+        }
+        const authUrl = `${base}/oauth2/auth?${authParams.toString()}`;
+        let jar = "";
+        const authResp = await fetch(authUrl, { method: "GET", redirect: "manual" });
+        jar = mergeCookieJarForSignin(jar, authResp);
+        if (authResp.status !== 302 && authResp.status !== 303 && authResp.status !== 307) {
+            const t = await authResp.text();
+            throw new HttpError(authResp.status, authResp.statusText, t);
+        }
+        const authLoc = authResp.headers.get("location");
+        if (!authLoc) {
+            throw new HttpError(authResp.status, "Missing Location after /oauth2/auth", "");
+        }
+        const signinUrl = new URL(authLoc, base);
+        if (!signinUrl.pathname.includes("signin")) {
+            throw new Error(`Expected redirect to a sign-in page, got: ${authLoc}`);
+        }
+        const signinPageResp = await fetch(signinUrl.href, {
+            method: "GET",
+            headers: {
+                Cookie: jar,
+                Accept: "text/html,application/xhtml+xml,application/xml;q=0.9,*/*;q=0.8",
+            },
+            redirect: "manual",
+        });
+        jar = mergeCookieJarForSignin(jar, signinPageResp);
+        if (signinPageResp.status !== 200) {
+            const t = await signinPageResp.text();
+            throw new HttpError(signinPageResp.status, signinPageResp.statusText, t);
+        }
+        const html = await signinPageResp.text();
+        const parsed = parseSigninPageHtmlProps(html);
+        const loginChallenge = signinUrl.searchParams.get("login_challenge")?.trim() || parsed.challenge?.trim();
+        if (!loginChallenge) {
+            throw new Error("Could not resolve login challenge: missing login_challenge in sign-in URL and __NEXT_DATA__.props.pageProps.challenge.");
+        }
+        const csrftoken = parsed.csrftoken;
+        const remember = parsed.remember ?? false;
+        const keyPath = options.signinPublicKeyPemPath?.trim() ||
+            (typeof process.env.KWEAVER_SIGNIN_RSA_PUBLIC_KEY === "string"
+                ? process.env.KWEAVER_SIGNIN_RSA_PUBLIC_KEY.trim()
+                : "");
+        const pems = keyPath
+            ? [
+                resolveSigninPublicKeyPem((await readFile(keyPath, "utf8")).trim(), {
+                    allowBuiltinModulus: false,
+                }),
+            ]
+            : buildHttpSigninPemCandidates(parsed.rsaPublicKeyMaterial);
+        const usePlainB64 = options.signinPasswordBase64Plain === true
+            ? true
+            : options.signinPasswordBase64Plain === false
+                ? false
+                : process.env.KWEAVER_SIGNIN_PASSWORD_B64_RSA_MIN !== "1";
+        // Body shape matches browser `POST /oauth2/signin` (EACP / oauth2-ui); omitting vcode/dualfactorauthinfo
+        // causes 400 from eachttpserver (invalid parameter).
+        const postBody = {
+            _csrf: csrftoken,
+            challenge: loginChallenge,
+            account: options.username,
+            password: "",
+            vcode: { id: "", content: "" },
+            dualfactorauthinfo: {
+                validcode: { vcode: "" },
+                OTP: { OTP: "" },
+            },
+            remember,
+            device: {
+                name: "",
+                description: "",
+                client_type: "unknown",
+                udids: [],
+            },
+        };
+        const origin = new URL(base).origin;
+        /** Some gateways (e.g. DIP) return HTTP 200 + `{"redirect":"..."}` instead of 3xx Location. */
+        let signinRedirectFromJson;
+        // Single fixed RSA public key (STUDIOWEB_LOGIN_PUBLIC_KEY_PEM) unless the caller overrides via
+        // --signin-public-key-file / KWEAVER_SIGNIN_RSA_PUBLIC_KEY. No fallback list, no candidate noise.
+        const pem = pems[0];
+        const encrypted = publicEncrypt({ key: pem, padding: cryptoConstants.RSA_PKCS1_PADDING }, Buffer.from(options.password, "utf8"));
+        const rawB64 = encrypted.toString("base64");
+        const passwordB64 = usePlainB64 ? rawB64 : formatPasswordBase64LikeRsaMin(rawB64);
+        postBody.password = passwordB64;
+        const postResp = await fetch(`${base}/oauth2/signin`, {
+            method: "POST",
+            headers: {
+                Cookie: jar,
+                "Content-Type": "application/json",
+                Accept: "application/json, text/plain, */*",
+                Origin: origin,
+                Referer: signinUrl.href,
+            },
+            body: JSON.stringify(postBody),
+            redirect: "manual",
+        });
+        jar = mergeCookieJarForSignin(jar, postResp);
+        if (postResp.status !== 302 && postResp.status !== 303 && postResp.status !== 307) {
+            const bodyText = await postResp.text();
+            if (/RSA_private_decrypt/i.test(bodyText)) {
+                throw new Error("HTTP sign-in: RSA ciphertext rejected by server. The built-in STUDIOWEB_LOGIN_PUBLIC_KEY_PEM " +
+                    "does not match this deployment's `/oauth2/signin` public key. Provide the correct key via " +
+                    "--signin-public-key-file <pem> or KWEAVER_SIGNIN_RSA_PUBLIC_KEY=...");
+            }
+            if (postResp.status === 200) {
+                const ct = postResp.headers.get("content-type") ?? "";
+                const looksLikeJson = ct.includes("application/json") || /^\s*\{/.test(bodyText);
+                if (looksLikeJson) {
+                    let j;
+                    try {
+                        j = JSON.parse(bodyText);
+                    }
+                    catch {
+                        throw new Error(`Sign-in failed: ${bodyText.slice(0, 500)}`);
+                    }
+                    const redir = j.redirect;
+                    if (typeof redir === "string" && redir.trim() !== "") {
+                        signinRedirectFromJson = redir.trim();
+                    }
+                    else {
+                        const msg = typeof j.message === "string"
+                            ? j.message
+                            : typeof j.error === "string"
+                                ? j.error
+                                : bodyText.slice(0, 500);
+                        throw new Error(`Sign-in failed: ${msg}`);
+                    }
+                }
+                else {
+                    throw new Error("Sign-in POST returned 200 without redirect. Check password, CSRF, or RSA public key PEM.");
+                }
+            }
+            else {
+                throw new HttpError(postResp.status, postResp.statusText, bodyText);
+            }
+        }
+        let code;
+        if (signinRedirectFromJson) {
+            const out = await followSigninRedirectsUntilCallback(new URL(signinRedirectFromJson, base).href, jar, state, redirectUri, base, scope);
+            code = out.code;
+        }
+        else if (postResp.status === 302 || postResp.status === 303 || postResp.status === 307) {
+            const loc = postResp.headers.get("location");
+            if (!loc) {
+                throw new HttpError(postResp.status, "Missing Location after sign-in", "");
+            }
+            const out = await followSigninRedirectsUntilCallback(new URL(loc, base).href, jar, state, redirectUri, base, scope);
+            code = out.code;
+        }
+        else {
+            throw new Error("HTTP sign-in: exhausted RSA key candidates without redirect");
+        }
+        const token = await exchangeCodeForToken(base, code, client.clientId, client.clientSecret, redirectUri, pkce?.verifier, options.tlsInsecure);
+        const copyCommand = buildCopyCommand(base, client.clientId, client.clientSecret, token.refreshToken, options.tlsInsecure);
+        process.stderr.write("\nHTTP sign-in: copy this command for headless hosts:\n\n" + copyCommand + "\n\n");
+        setCurrentPlatform(base);
+        return token;
+    });
+}
 /**
  * Log in on a headless machine using OAuth2 client credentials and a refresh token (no browser).
  * Exchanges the refresh token for a new access token and persists ~/.kweaver/ state.
@@ -952,6 +1591,13 @@ export async function withTokenRetry(fn) {
                 throw error;
             }
             const platformUrl = normalizeBaseUrl(token.baseUrl);
+            // env-sourced token: no refresh_token / OAuth client — refresh is impossible.
+            // Surface an env-aware hint instead of telling the user to `auth login` (which writes to disk).
+            if (process.env.KWEAVER_TOKEN && !token.refreshToken) {
+                throw new Error(`Authentication failed (401) for ${platformUrl}. Your KWEAVER_TOKEN appears to be invalid or expired.\n` +
+                    `  - Refresh the token and re-export: export KWEAVER_TOKEN=<new-token>\n` +
+                    `  - Or run \`kweaver auth login ${platformUrl}\` to save a full session (with refresh_token) to ~/.kweaver/.`, { cause: error });
+            }
             const envUser = process.env.KWEAVER_USER;
             let latest;
             if (envUser) {

package/dist/cli.js

@@ -21,7 +21,7 @@ Usage:
   kweaver --version | -V
   kweaver --help | -h
 
-  kweaver auth <platform-url> [--alias name] [--no-auth] [--no-browser] [-u user] [-p pass] [--playwright] [--insecure|-k]
+  kweaver auth <platform-url> [--alias name] [--no-auth] [--no-browser] [-u user] [-p pass] [--http-signin] [--playwright] [--insecure|-k]
   kweaver auth login <platform-url>          (alias for auth <url>)
   kweaver auth login <url> --client-id ID --client-secret S --refresh-token T   (run on host without browser)
   kweaver auth whoami [platform-url|alias] [--json]

package/dist/commands/auth.js

@@ -1,14 +1,25 @@
 import { isNoAuth } from "../config/no-auth.js";
 import { autoSelectBusinessDomain, clearPlatformSession, deletePlatform, deleteUser, getActiveUser, getConfigDir, getCurrentPlatform, getPlatformAlias, hasPlatform, listPlatforms, listUserProfiles, loadClientConfig, loadTokenConfig, resolveBusinessDomain, resolvePlatformIdentifier, resolveUserId, saveNoAuthPlatform, setActiveUser, setCurrentPlatform, setPlatformAlias, } from "../config/store.js";
 import { decodeJwtPayload } from "../config/jwt.js";
-import { buildCopyCommand, formatHttpError, normalizeBaseUrl, oauth2Login, playwrightLogin, refreshTokenLogin, } from "../auth/oauth.js";
+import { buildCopyCommand, formatHttpError, isStudiowebShellUnavailableError, normalizeBaseUrl, oauth2Login, oauth2PasswordSigninLogin, playwrightLogin, refreshTokenLogin, } from "../auth/oauth.js";
+/** True when the `playwright` npm package can be imported (browser binaries may still need `npx playwright install`). */
+async function isPlaywrightPackageResolvable() {
+    try {
+        const modName = "playwright";
+        await import(/* webpackIgnore: true */ modName);
+        return true;
+    }
+    catch {
+        return false;
+    }
+}
 export async function runAuthCommand(args) {
     const target = args[0];
     const rest = args.slice(1);
     if (!target || target === "--help" || target === "-h") {
         console.log(`kweaver auth login <url> [options]   Login to a platform (browser OAuth2 by default)
 kweaver auth <url>                   Login (shorthand; same options as login)
-kweaver auth whoami [url|alias]      Show current user identity (from id_token)
+kweaver auth whoami [url|alias] [--json]  Show current user identity (from id_token)
 kweaver auth export [url|alias] [--json]   Export credentials; run printed command on a headless host
 kweaver auth status [url|alias]      Show current auth status
 kweaver auth list                    List all platforms and users (tree view)
@@ -30,16 +41,17 @@ Login options:
   --port <n>             Local callback port (default: 9010). Use when 9010 is occupied.
   --no-browser           Do not open a browser; print the auth URL and prompt for the callback URL or code (stdin).
                          Use on headless servers or when automatic browser launch fails.
-  -u, --username         Username (with -p triggers Playwright headless login)
-  -p, --password         Password
-  --playwright           Force Playwright browser login even without -u/-p
+  -u, --username         Username (with -p: tries HTTP /oauth2/signin first when the Studio web shell is available)
+  -p, --password         Password (with -u: falls back to Playwright headless only when studioweb is unavailable and Playwright is installed)
+  --http-signin          With -u/-p: HTTP POST /oauth2/signin only (no Playwright fallback). Uses the built-in RSA public key.
+  --playwright           With -u/-p: force Playwright (skip HTTP sign-in). Without -u/-p: open Playwright for manual login.
   --insecure, -k         Skip TLS certificate verification (self-signed / dev HTTPS only)
   --no-auth              Save platform without OAuth (servers with no authentication). Same as detecting OAuth 404 during login.`);
         return 0;
     }
     if (target === "login") {
         if (rest[0] === "--help" || rest[0] === "-h") {
-            console.log(`kweaver auth login <platform-url> [--alias <name>] [--no-auth] [--no-browser] [-u user] [-p pass] [--playwright] [--refresh-token T --client-id ID --client-secret S]`);
+            console.log(`kweaver auth login <platform-url> [--alias <name>] [--no-auth] [--no-browser] [-u user] [-p pass] [--http-signin] [--playwright] [--refresh-token T --client-id ID --client-secret S]`);
             return 0;
         }
         const url = rest[0];
@@ -69,6 +81,9 @@ Login options:
             const username = readOption(args, "--username") ?? readOption(args, "-u");
             const password = readOption(args, "--password") ?? readOption(args, "-p");
             const usePlaywright = args.includes("--playwright");
+            const httpSignin = args.includes("--http-signin");
+            const oauthProduct = readOption(args, "--oauth-product");
+            const signinPublicKeyFile = readOption(args, "--signin-public-key-file");
             const clientId = readOption(args, "--client-id");
             const clientSecret = readOption(args, "--client-secret");
             const refreshToken = readOption(args, "--refresh-token");
@@ -83,11 +98,16 @@ Login options:
             const KNOWN_LOGIN_FLAGS = new Set([
                 "--alias", "--client-id", "--client-secret", "--refresh-token",
                 "--port", "--no-browser", "--username", "-u", "--password", "-p",
+                "--http-signin",
+                "--oauth-product",
+                "--signin-public-key-file",
                 "--playwright", "--insecure", "-k", "--no-auth", "--redirect-uri",
             ]);
             const KNOWN_VALUE_FLAGS = new Set([
                 "--alias", "--client-id", "--client-secret", "--refresh-token",
                 "--port", "--username", "-u", "--password", "-p", "--redirect-uri",
+                "--oauth-product",
+                "--signin-public-key-file",
             ]);
             for (let i = 0; i < args.length; i++) {
                 const a = args[i];
@@ -110,12 +130,24 @@ Login options:
             if (noAuth && noBrowser) {
                 console.error("--no-auth does not require a browser; --no-browser is ignored.");
             }
-            if (noAuth && (username || password || usePlaywright)) {
-                console.error("--no-auth cannot be used with Playwright login or -u/-p.");
+            if (noAuth && (username || password || usePlaywright || httpSignin)) {
+                console.error("--no-auth cannot be used with Playwright login, HTTP sign-in, or -u/-p.");
+                return 1;
+            }
+            if (noBrowser && (username || password || usePlaywright || httpSignin)) {
+                console.error("--no-browser cannot be used with Playwright login, HTTP sign-in, or -u/-p.");
                 return 1;
             }
-            if (noBrowser && (username || password || usePlaywright)) {
-                console.error("--no-browser cannot be used with Playwright login or -u/-p.");
+            if (httpSignin && usePlaywright) {
+                console.error("--http-signin cannot be used with --playwright.");
+                return 1;
+            }
+            if (httpSignin && refreshToken) {
+                console.error("--http-signin cannot be used with --refresh-token.");
+                return 1;
+            }
+            if (httpSignin && (!username || !password)) {
+                console.error("--http-signin requires -u/--username and -p/--password.");
                 return 1;
             }
             if (noBrowser && refreshToken) {
@@ -137,12 +169,67 @@ Login options:
                     clientId, clientSecret, refreshToken, tlsInsecure,
                 });
             }
-            else if (username && password) {
-                console.log("Logging in (headless)...");
+            else if (username && password && httpSignin) {
+                console.log("Logging in (HTTP /oauth2/signin)...");
+                token = await oauth2PasswordSigninLogin(normalizedTarget, {
+                    username,
+                    password,
+                    tlsInsecure,
+                    port: customPort,
+                    clientId: clientId ?? undefined,
+                    clientSecret: clientSecret ?? undefined,
+                    oauthProduct: oauthProduct ?? undefined,
+                    signinPublicKeyPemPath: signinPublicKeyFile ?? undefined,
+                });
+            }
+            else if (username && password && usePlaywright) {
+                console.log("Logging in (headless, Playwright)...");
                 token = await playwrightLogin(normalizedTarget, {
-                    username, password, tlsInsecure, port: customPort,
+                    username,
+                    password,
+                    tlsInsecure,
+                    port: customPort,
                 });
             }
+            else if (username && password) {
+                const signinOpts = {
+                    username,
+                    password,
+                    tlsInsecure,
+                    port: customPort,
+                    clientId: clientId ?? undefined,
+                    clientSecret: clientSecret ?? undefined,
+                    oauthProduct: oauthProduct ?? undefined,
+                    signinPublicKeyPemPath: signinPublicKeyFile ?? undefined,
+                };
+                console.log("Logging in (HTTP /oauth2/signin)...");
+                try {
+                    token = await oauth2PasswordSigninLogin(normalizedTarget, signinOpts);
+                }
+                catch (err) {
+                    if (!isStudiowebShellUnavailableError(err)) {
+                        throw err;
+                    }
+                    const playwrightOk = await isPlaywrightPackageResolvable();
+                    if (playwrightOk) {
+                        process.stderr.write("Studio web sign-in shell is not available; falling back to Playwright headless login.\n");
+                        console.log("Logging in (headless, Playwright)...");
+                        token = await playwrightLogin(normalizedTarget, {
+                            username,
+                            password,
+                            tlsInsecure,
+                            port: customPort,
+                        });
+                    }
+                    else {
+                        console.error("Studio web sign-in shell is not available on this platform, and the Playwright package is not installed.");
+                        console.error("Install Playwright for headless browser login: npm install playwright && npx playwright install chromium");
+                        console.error("Alternatively, use OAuth without credentials:");
+                        console.error(`  kweaver auth login ${normalizedTarget} --no-browser`);
+                        throw err;
+                    }
+                }
+            }
             else if (usePlaywright) {
                 console.log("Opening browser for login (Playwright)...");
                 token = await playwrightLogin(normalizedTarget, {
@@ -217,8 +304,19 @@ Login options:
         const statusTarget = resolvedTarget && /^https?:\/\//.test(resolvedTarget) ? normalizeBaseUrl(resolvedTarget) : resolvedTarget ?? undefined;
         const platform = statusTarget ?? getCurrentPlatform();
         if (!platform) {
-            console.error("No active platform. Run `kweaver auth login <platform-url>` first.");
-            return 1;
+            const envRaw = process.env.KWEAVER_BASE_URL?.trim();
+            const envUrl = envRaw ? normalizeBaseUrl(envRaw) : undefined;
+            const envToken = process.env.KWEAVER_TOKEN?.trim();
+            if (!envUrl || !envToken) {
+                console.error("No active platform. Run `kweaver auth login <platform-url>` first.\n" +
+                    "  Tip: set KWEAVER_BASE_URL and KWEAVER_TOKEN to use this command without a saved login.");
+                return 1;
+            }
+            console.log(`Config directory: ${getConfigDir()}`);
+            console.log(`Platform:         ${envUrl} (KWEAVER_BASE_URL)`);
+            console.log(`Token present:    yes (KWEAVER_TOKEN)`);
+            console.log(`Refresh token:    n/a (env)`);
+            return 0;
         }
         const token = loadTokenConfig(platform);
         if (!token) {
@@ -359,7 +457,7 @@ Login options:
         return 0;
     }
     console.error("Usage: kweaver auth login <platform-url> [--alias <name>] [-u user] [-p pass] [--playwright]");
-    console.error("       kweaver auth whoami [platform-url|alias]");
+    console.error("       kweaver auth whoami [platform-url|alias] [--json]");
     console.error("       kweaver auth export [platform-url|alias] [--json]");
     console.error("       kweaver auth status [platform-url|alias]");
     console.error("       kweaver auth list");
@@ -456,8 +554,37 @@ Options:
     const resolved = positional ? resolvePlatformIdentifier(positional) : null;
     const platform = resolved && /^https?:\/\//.test(resolved) ? normalizeBaseUrl(resolved) : resolved ?? getCurrentPlatform();
     if (!platform) {
-        console.error("No active platform. Run `kweaver auth login <platform-url>` first.");
-        return 1;
+        const envRaw = process.env.KWEAVER_BASE_URL?.trim();
+        const envUrl = envRaw ? normalizeBaseUrl(envRaw) : undefined;
+        const envToken = process.env.KWEAVER_TOKEN?.trim();
+        if (!envUrl || !envToken) {
+            console.error("No active platform. Run `kweaver auth login <platform-url>` first.");
+            return 1;
+        }
+        const accessToken = envToken.replace(/^Bearer\s+/i, "");
+        const payload = decodeJwtPayload(accessToken);
+        if (jsonOutput) {
+            console.log(JSON.stringify({ platform: envUrl, source: "env", ...(payload ?? {}) }, null, 2));
+            return 0;
+        }
+        console.log(`Platform: ${envUrl}`);
+        console.log(`Source:   env (KWEAVER_TOKEN)`);
+        if (payload) {
+            const uname = payload.preferred_username ?? payload.name;
+            if (uname)
+                console.log(`Username: ${uname}`);
+            console.log(`User ID:  ${payload.sub ?? "(unknown)"}`);
+            console.log(`Issuer:   ${payload.iss ?? "(unknown)"}`);
+            if (payload.iat)
+                console.log(`Issued:   ${new Date(payload.iat * 1000).toISOString()}`);
+            if (payload.exp)
+                console.log(`Expires:  ${new Date(payload.exp * 1000).toISOString()}`);
+        }
+        else {
+            console.log(`User info unavailable: opaque access token.`);
+            console.log(`Hint: run \`kweaver auth login ${envUrl}\` to obtain a full session.`);
+        }
+        return 0;
     }
     const token = loadTokenConfig(platform);
     if (!token) {

package/dist/commands/config.js

@@ -1,5 +1,14 @@
 import { listBusinessDomains } from "../api/business-domains.js";
-import { withTokenRetry } from "../auth/oauth.js";
+import { normalizeBaseUrl, withTokenRetry } from "../auth/oauth.js";
+// Resolve platform URL: saved current platform > KWEAVER_BASE_URL (normalized to
+// match what `auth login` writes, so env users share the same platforms/<key>/ dir).
+function resolvePlatformUrl() {
+    const saved = getCurrentPlatform();
+    if (saved)
+        return saved;
+    const env = process.env.KWEAVER_BASE_URL?.trim();
+    return env ? normalizeBaseUrl(env) : undefined;
+}
 import { getCurrentPlatform, loadPlatformBusinessDomain, resolveBusinessDomain, savePlatformBusinessDomain, } from "../config/store.js";
 const HELP = `kweaver config
 
@@ -20,9 +29,9 @@ export async function runConfigCommand(args) {
         return 0;
     }
     if (sub === "show") {
-        const platform = getCurrentPlatform();
+        const platform = resolvePlatformUrl();
         if (!platform) {
-            console.error("No active platform. Run `kweaver auth login <url>` first.");
+            console.error("No active platform. Run `kweaver auth login <url>` first.\n  Tip: set KWEAVER_BASE_URL to use this command without a saved login.");
             return 1;
         }
         const bd = resolveBusinessDomain(platform);
@@ -31,7 +40,8 @@ export async function runConfigCommand(args) {
             : loadPlatformBusinessDomain(platform)
                 ? "config"
                 : "default";
-        console.log(`Platform:        ${platform}`);
+        const platformSource = getCurrentPlatform() ? "" : " (KWEAVER_BASE_URL)";
+        console.log(`Platform:        ${platform}${platformSource}`);
         console.log(`Business Domain: ${bd} (${source})`);
         return 0;
     }
@@ -41,19 +51,19 @@ export async function runConfigCommand(args) {
             console.error("Usage: kweaver config set-bd <value>");
             return 1;
         }
-        const platform = getCurrentPlatform();
+        const platform = resolvePlatformUrl();
         if (!platform) {
-            console.error("No active platform. Run `kweaver auth login <url>` first.");
+            console.error("No active platform. Run `kweaver auth login <url>` first.\n  Tip: set KWEAVER_BASE_URL to write the business domain for that platform.");
             return 1;
         }
         savePlatformBusinessDomain(platform, value);
-        console.log(`Business domain set to: ${value}`);
+        console.log(`Business domain set to: ${value} (${getCurrentPlatform() ? platform : `${platform} via KWEAVER_BASE_URL`})`);
         return 0;
     }
     if (sub === "list-bd") {
-        const platform = getCurrentPlatform();
+        const platform = resolvePlatformUrl();
         if (!platform) {
-            console.error("No active platform. Run `kweaver auth login <url>` first.");
+            console.error("No active platform. Run `kweaver auth login <url>` first.\n  Tip: set KWEAVER_BASE_URL and KWEAVER_TOKEN to use this command without a saved login.");
             return 1;
         }
         try {

package/dist/commands/context-loader.js

@@ -281,20 +281,26 @@ async function runGetPrompt(options, args, pretty) {
 async function runKnSearch(options, args, pretty) {
     let query;
     let onlySchema = false;
+    let knIdOverride;
     for (let i = 0; i < args.length; i += 1) {
         const arg = args[i];
         if (arg === "--only-schema") {
             onlySchema = true;
         }
+        else if ((arg === "--kn-id" || arg === "-k") && args[i + 1]) {
+            knIdOverride = args[i + 1];
+            i += 1;
+        }
         else if (!arg.startsWith("-") && !query) {
             query = arg;
         }
     }
     if (!query) {
-        console.error("Usage: kweaver context-loader kn-search <query> [--only-schema]");
+        console.error("Usage: kweaver context-loader kn-search <query> [--kn-id <id>] [--only-schema]");
         return 1;
     }
-    const result = await knSearch(options, { query, only_schema: onlySchema });
+    const effectiveOptions = knIdOverride ? { ...options, knId: knIdOverride } : options;
+    const result = await knSearch(effectiveOptions, { query, only_schema: onlySchema });
     console.log(formatOutput(result, pretty));
     return 0;
 }

package/dist/commands/ds.d.ts

@@ -17,6 +17,7 @@ export declare function resolveFiles(pattern: string): Promise<string[]>;
 export interface ImportCsvResult {
     code: number;
     tables: string[];
+    failed: string[];
     tableColumns: Record<string, string[]>;
     sampleRows: Record<string, Array<Record<string, string | null>>>;
 }

package/dist/commands/ds.js

@@ -384,17 +384,17 @@ export async function runDsImportCsv(args) {
     catch (error) {
         if (error instanceof Error && error.message === "help") {
             console.log(IMPORT_CSV_HELP);
-            return { code: 0, tables: [], tableColumns: {}, sampleRows: {} };
+            return { code: 0, tables: [], failed: [], tableColumns: {}, sampleRows: {} };
         }
         throw error;
     }
     if (!options.datasourceId) {
         console.error("Usage: kweaver ds import-csv <ds-id> --files <glob_or_list> [options]");
-        return { code: 1, tables: [], tableColumns: {}, sampleRows: {} };
+        return { code: 1, tables: [], failed: [], tableColumns: {}, sampleRows: {} };
     }
     if (!options.files) {
         console.error("Error: --files is required");
-        return { code: 1, tables: [], tableColumns: {}, sampleRows: {} };
+        return { code: 1, tables: [], failed: [], tableColumns: {}, sampleRows: {} };
     }
     // 1. Get credentials
     const token = await ensureValidToken();
@@ -429,7 +429,7 @@ export async function runDsImportCsv(args) {
     }
     if (parsed.length === 0) {
         console.error("All files were skipped — nothing to import");
-        return { code: 1, tables: [], tableColumns: {}, sampleRows: {} };
+        return { code: 1, tables: [], failed: [], tableColumns: {}, sampleRows: {} };
     }
     // Phase 2: Import each file in batches
     const succeeded = [];
@@ -487,14 +487,14 @@ export async function runDsImportCsv(args) {
     if (failed.length > 0) {
         console.error(`Failed tables: ${failed.join(", ")}`);
     }
-    console.log(JSON.stringify({
-        tables: succeeded,
-        failed,
-        summary: { succeeded: succeeded.length, failed: failed.length },
-    }, null, 2));
-    return { code: failed.length > 0 ? 1 : 0, tables: succeeded, tableColumns, sampleRows };
+    return { code: failed.length > 0 ? 1 : 0, tables: succeeded, failed, tableColumns, sampleRows };
 }
 export async function runDsImportCsvCommand(args) {
     const result = await runDsImportCsv(args);
+    console.log(JSON.stringify({
+        tables: result.tables,
+        failed: result.failed,
+        summary: { succeeded: result.tables.length, failed: result.failed.length },
+    }, null, 2));
     return result.code;
 }

package/dist/index.d.ts

@@ -62,3 +62,4 @@ export type { TokenConfig, ContextLoaderEntry, ContextLoaderConfig, } from "./co
 export type { UserProfile } from "./config/store.js";
 export { NO_AUTH_TOKEN, isNoAuth, saveNoAuthPlatform, autoSelectBusinessDomain, getConfigDir, getCurrentPlatform, getActiveUser, setActiveUser, listUsers, listUserProfiles, resolveUserId, extractUserId, } from "./config/store.js";
 export { decodeJwtPayload, extractUserIdFromJwt } from "./config/jwt.js";
+export { DEFAULT_SIGNIN_RSA_MODULUS_HEX, oauth2PasswordSigninLogin, parseSigninPageHtmlProps, rsaModulusHexToSpkiPem, STUDIOWEB_LOGIN_PUBLIC_KEY_PEM, } from "./auth/oauth.js";

package/dist/index.js

@@ -49,3 +49,5 @@ export { HttpError, NetworkRequestError, fetchTextOrThrow } from "./utils/http.j
 export { NO_AUTH_TOKEN, isNoAuth, saveNoAuthPlatform, autoSelectBusinessDomain, getConfigDir, getCurrentPlatform, getActiveUser, setActiveUser, listUsers, listUserProfiles, resolveUserId, extractUserId, } from "./config/store.js";
 // ── JWT utilities ─────────────────────────────────────────────────────────────
 export { decodeJwtPayload, extractUserIdFromJwt } from "./config/jwt.js";
+// ── OAuth (advanced — CLI uses these internally; optional for custom login tools) ─
+export { DEFAULT_SIGNIN_RSA_MODULUS_HEX, oauth2PasswordSigninLogin, parseSigninPageHtmlProps, rsaModulusHexToSpkiPem, STUDIOWEB_LOGIN_PUBLIC_KEY_PEM, } from "./auth/oauth.js";

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@kweaver-ai/kweaver-sdk",
-  "version": "0.6.3",
+  "version": "0.6.4",
   "description": "KWeaver TypeScript SDK — CLI tool and programmatic API for knowledge networks and Decision Agents.",
   "type": "module",
   "main": "./dist/index.js",